Updated 2026-09-27

GitHub Action

The LyraShield GitHub Action is a lightweight, diff-scoped security gate that runs entirely in your own runner with your own GITHUB_TOKEN. It does not call the hosted LyraShield engine, does not require a LyraShield account or API key and requests no elevated permissions of its own — the calling workflow controls the token scope.

What it checks: secret detection via gitleaks, plus a set of high-signal risky-pattern checks on the lines added in the diff — hardcoded secrets, SQL-injection-shaped string concatenation, security controls disabled in code (CORS, CSRF, XSS protections) and eval/exec usage. This is a fast, zero-setup pre-merge gate, not the full agentic scan. To review retest outcomes and coverage receipts, connect the target in the LyraShield app or use the MCP server or REST API.

Add the workflow

Create .github/workflows/lyrashield.yml in your repository. This is the whole setup — no secrets to configure:

name: LyraShield security checks

on:
  pull_request:
    branches: [main]

jobs:
  lyrashield:
    name: Run security checks
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write  # optional: only needed to publish SARIF to Code Scanning
    steps:
      - name: LyraShield check
        uses: ecryptoguru/lyrashield-ai@v2
        with:
          fail_on_severity: HIGH

That single step checks out your repository itself (with the depth the diff calculation needs), so you don't need a separate actions/checkout step before it.

Inputs

Input	Default	Description
`scan_mode`	`SAFE`	`SAFE` or `AGGRESSIVE` (also scans config/doc file types). `DEEP` is reserved and currently runs `SAFE`-equivalent coverage.
`fail_on_severity`	`HIGH`	Fail the check when a finding at or above this severity is present: `CRITICAL`, `HIGH`, `MEDIUM`, `LOW` or `INFO`.
`target_ref`	(empty)	Git ref/SHA to scan as HEAD. Defaults to the PR head, then the checked-out HEAD.
`fetch_depth`	`0`	Checkout depth. `0` (full history) is required for accurate diff derivation.

Results

Findings are written to a SARIF file and archived as a workflow artifact on every run. If the job grants security-events: write, they're also uploaded to GitHub Code Scanning under the lyrashield-diff-scan category — that upload is optional and best-effort; the pass/fail gate itself does not depend on it. All third-party actions this workflow uses internally are SHA-pinned.

Requirements: a GitHub Actions runner with network access to fetch the pinned third-party actions (gitleaks, upload-artifact, codeql-action). No Node.js installation, LyraShield account or API key is required for this workflow.

Cloud editor complement

For teams using cloud editors like Lovable, Bolt.new, Replit or v0, the GitHub Action provides automated CI checks on the synced repository. The action runs independently of the editor's MCP connection and works even if the editor does not support custom remote MCP — see the remote MCP page for the complementary in-editor path.